e3ba5914a21e8c60f57f747b6f135d5a343a03775392056975469f69c9c42387

General

Target
setup-chevroletexplorer-v1.7.exe
Size 1.1MB
Sample260727-rdb2qafp3x
SHA256 e3ba5914a21e8c60f57f747b6f135d5a343a03775392056975469f69c9c42387
MD5 38f604651cbf63d923f1e002dc4ab289
SHA1 97a720609aeca675e83c9d09a86434c80641c1d1
SHA512 d42b0964ae694af0a4922733a4bd5874397068fe7357c147d5579b8cd7b84d13f274d3e0a372443a6d7556a85ef9eaf6af9ce15aecba81e5962927709151d1cb
SSDEEP 24576:OdY1eN6AZaVxZosGnAXQw7tHD03EwdoGfZyDGdMUy:OdY8N+fgw75DMoCmJ
TLSH
T19D352221F48188B3C115177C9C1BD928D4397710AEF961CBB3EA1F9D8EE12961D392BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4640	CheviExplorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Chevrolet Explorer\CheviExplorer.chm	setup-chevroletexplorer-v1.7.exe
File opened for modification	C:\Program Files (x86)\Chevrolet Explorer\CE.ini	setup-chevroletexplorer-v1.7.exe
File opened for modification	C:\Program Files (x86)\Chevrolet Explorer\Uninstall.exe	setup-chevroletexplorer-v1.7.exe
File created	C:\Program Files (x86)\Chevrolet Explorer\Uninstall.ini	setup-chevroletexplorer-v1.7.exe
File opened for modification	C:\Program Files (x86)\Chevrolet Explorer\CheviExplorer.exe	setup-chevroletexplorer-v1.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-chevroletexplorer-v1.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheviExplorer.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\shell	setup-chevroletexplorer-v1.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\shell\open\command\ = "C:\\Program Files (x86)\\Chevrolet Explorer\\CheviExplorer.exe \"%1\""	setup-chevroletexplorer-v1.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\DefaultIcon\ = "C:\\Program Files (x86)\\Chevrolet Explorer\\CheviExplorer.exe,0"	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\shell\open	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\shell\open\command	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile	setup-chevroletexplorer-v1.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\ = "Chevrolet Explorer"	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cedatfile\DefaultIcon	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	CheviExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cedat	setup-chevroletexplorer-v1.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cedat\ = "cedatfile"	setup-chevroletexplorer-v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	CheviExplorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6080	setup-chevroletexplorer-v1.7.exe
6080	setup-chevroletexplorer-v1.7.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 4640	6080	setup-chevroletexplorer-v1.7.exe	90

C:\Users\Admin\AppData\Local\Temp\setup-chevroletexplorer-v1.7.exe
"C:\Users\Admin\AppData\Local\Temp\setup-chevroletexplorer-v1.7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files (x86)\Chevrolet Explorer\CheviExplorer.exe
  "C:\Program Files (x86)\Chevrolet Explorer\CheviExplorer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheviExplorer.exe

Path C:\Program Files (x86)\Chevrolet Explorer\CheviExplorer.exe
Size 1.2MB
SHA256 5411918a4d245001e0a57982e3123768be0c4cf29cbd01c2e9401f06c54b6f01
MD5 a27cfe5d98c5a387fbefa6b866569edd
SHA1 08681605578fcf21ce86fd70cf74fca66a21fcf2
SHA512 ba18d2b87781e20b66b0c3058d05613f0d78ef582e85f255399bf49d02b9b3ce2701d9f90f5ca8ffab5014ace02194f667d8053f25c7640f946844e5c66a28f6
SSDEEP 24576:+F3lSdWS4aF8yFU6wo4m8Vi0ui9y5KkXGW6aAcQn5:+FoZOyAyELn
TLSH
T1AB459E23B3A18837C17326385C2BD7A86D36FE102F69598B3BF52D4C5F356827919293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Chevrolet Explorer\Uninstall.exe
Size 56KB
SHA256 df03ab4560baf64a2cd974d8fd5598c255c4f6e137d03509f20a6756fc5537bd
MD5 bb203da1283ba111a0015aae65638945
SHA1 c5defe1ceec93bdada6d5fb62c122c79ea0d506d
SHA512 268e19c8339f07397248ef07a7c18da6031dd029b7d3020ce0980c1cd760c4caa403dd5116c081faa2b30a5b821edd97ac8043e713cc317ea552e4620c440e6c
SSDEEP 768:yegPVaEXb+WoUTpmF0j57im5rUtoSnvGSp8lPBmeDN2llDhv1DVDV0OPPhg5mDJz:s71oupKBmSGg8vmemBg5mdVzvPzsM7
TLSH
T104437C02A58084F3F051C9FC5C1AEE25DEBD7921293E6093BBDF2BDDEF691834418656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4640-51-0x00000000004F8000-0x00000000004F9000-memory.dmp

Download

memory/4640-52-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4640-54-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/6080-19-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/6080-53-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads